Drupal security problem

Discussion in 'Integration' started by erald, Dec 23, 2010.

  1. erald

    erald aMember Pro Customer

    Joined:
    Jul 23, 2009
    Messages:
    20
    We are using the Verotel payment processor with Drupal. However I see a same problem with other payment plugins.
    My problem is that when you setup a member manually with an expiration date that the user still is able to login into drupal. The user is not blocked and worse the user still has access as if he has a subscription. I understand that normally the payment processor is controlling the user and when it deletes a subscription the drupal user is blocked and his roles are deleted.
    I thought when a user is expired the cron job would also set the drupal account to blocked and deletes the roles, but it seems that is not the case. This is a major problem since if a delete subscription is missed from the verotel server (which has happened) the expiration date in Amember is basically not blocking the user at all.

    How can I setup a cron job to daily go through the subscriptions and when a user does not have any valid subscription his access privileges are blocked in Drupal. I consider this as a major bug in the system also because there is no way you know if a delete message from Verotel is missed somehow. A user with expired subscriptions should not have access to Drupal at all.
  2. alexander

    alexander Administrator Staff Member

    Joined:
    Jan 8, 2003
    Messages:
    6,279
    I'm not sure how this cron job will help. Verotel plugin set expiration date to lifetime on initial signup so if delete message will not be received, payment still will be active in amember(and not expired) So cron job that will serahc for expired payments will not help.
    This is possible to modify plugin so it will set expiration date based on product period , but what if rebill message will not be received? User will not have access then even if he was billed, I think this is more worse situation.
  3. erald

    erald aMember Pro Customer

    Joined:
    Jul 23, 2009
    Messages:
    20
    Hi Alexander,

    That is not true. If a subscription is recurring and the rebill is missed it still will be active. A cron job would not change that since a recurring subscription does not have any expiration date.

    However I have also subscriptions which are not recurring or manual entered subscriptions which all have an end date. Not all of them get a delete message from the payment processor (depending which one you use pay.nl for example does not send a delete message at the end of a subscription) and the manually entered subscriptions are never getting any message.

    This means that although amember does not accept a login (expired subscription), drupal is still doing so since the account in drupal is not blocked but still active. I had some users who were still able to enter the member area although their subscription was expired due to this. One found a way to enter drupal directly and another one simply never logged out and thus still had access.

    If you change a subscription record manually to expire the account in Drupal is nicely blocked but this is never done automatically when an account is expired. I still would like to have a daily cron job running checking if an account has any active subscriptions and if not it should set the drupal account on blocked and remove the roles. (as is done when expiring an account manually) It will not affect recurring subscriptions even if a rebill is missed.

    So still would like to know how to setup a cron job which will check on daily basis if an account has any active subscriptions, if not it should block the drupal account also.
  4. alexander

    alexander Administrator Staff Member

    Joined:
    Jan 8, 2003
    Messages:
    6,279
    Erald,
    This does not matter how subscription will expire manually or automatically. aMember will execute subscription_deleted hook in both situations, so if user blocked in Drupal when you expire it manually, the same thing should happen when script do this automatically.
    If this does not happen, there seems to be an issue in cron jobs that being executed by aMember, and this can affect other proccesses that aMember execute daily.
    Please contact us in helpdesk, provide access info and example of users who can access Drupal with expired subscription I will check what can be wrong.

Share This Page